Simplest lemma in software foundations can't be discharged?